3 ms·
I spun up a trial instance just for fun, and indeed, it's as easy and fool-proof as it sounds. This is something where some one can run some google dorks for t
by big_chungus 7y ago
I spun up a trial instance just for fun, and indeed, it's as easy and fool-proof as it sounds. This is something where some one can run some google dorks for the right forum and throw results into a twenty-line script.
Interestingly enough, it appeared as though google somehow sanitized the dork proposed in the actual post to return few to no forums, at least when I checked this morning. Checking now from a different IP returns a lot more; very weird.
The actual post to seclists for reference: https://seclists.org/fulldisclosure/2019/Sep/31 https://seclists.org/fulldisclosure/2019/Sep/31
Also, why on God's green earth to devs put version numbers so obviously in the software? For instance, on my web servers, I always turn off version number and platform, so an attacker can't easily go hunt down vulns from scraping the web. It seems as though it would be wise to make no version numbers that easily accessible the default.
- bluedino 7y agoProbably easier to just try the whole bag of exploits
- lbotos 7y agoYou are advocating for security by obscurity. Which is a "deterrent" not a solution. Version numbers help people get support and know when/where versions are fixed and if they are patched/updated. A solution is running up to date software, and encouraging developers to release security fixes and for admins to care.
- shakna 7y agoVersion numbers can still be handed to people without having to appear in every single request. It is a deterrent, and not a solution. But it does prevent the clouds of botnets from labeling you as definitely vulnerable and attacking you the moment a new 0-day gets purchased. The speed of attacks can outpace your speed of your upgrade process. Security-in-depth should always be the way forward. This is just another tickbox you can use.
- RandomTisk 7y agoI agree, it's more like a "sane default".
- big_chungus 7y agoI'm not advocating for using it as a sole defense, I'm saying it can cut down on log noise and won't hurt. Relying on security by obscurity is stupid; reducing the amount of information available to an attacker is smart.
- aaron695 7y ago> Which is a "deterrent" not a solution. How on earth did we get to a place where deterrents where somehow looked down on? Deterrents are the basis of order at every level of society. Nothing is a 'solution', everything is a deterrent. How obscurity go put into this meme, is interesting, but at the end of the day has to die. > admins to care. Admins how know their stuff enough to kill metadata that most admins are to lazy to fix, care.
- newnewpdro 7y agoThey're doing nothing of the sort. All software will have bugs. There's no good reason to accurately broadcast to the world what specific version you're running of anything, ever. It's not advocating leaving your production systems to rot with ancient software because you've hidden the versions. You still need to stay vigilant. But the reality is, 0-days happen, and not all bugs being exploited are reported/fixed. Keep the version hidden, or hell, broadcast a completely different software/version altogether.
- mcpherrinm 7y agoI tried the Google dork search on Tuesday morning when I saw the Full Disclosure email. At that time, a lot of servers showed up. All the top ones had been vandalized already.